CVSS: 5.0EPSS: 0%CPEs: 17EXPL: 0CVE-2025-42968 – Missing Authorization check in SAP NetWeaver (RFC enabled function module)
https://notcve.org/view.php?id=CVE-2025-42968
08 Jul 2025 — SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application. • https://me.sap.com/notes/3621037 • CWE-862: Missing Authorization •
CVSS: 3.3EPSS: 0%CPEs: 17EXPL: 0CVE-2025-42954 – Denial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application)
https://notcve.org/view.php?id=CVE-2025-42954
08 Jul 2025 — SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected resource. This leads to low impact on availability of the application, there is no impact on confidentiality and integrity. • https://me.sap.com/notes/3608156 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2025-31331 – Authorization Bypass vulnerability in SAP NetWeaver
https://notcve.org/view.php?id=CVE-2025-31331
08 Apr 2025 — SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the ABAP system, the attacker can run a specific transaction that exposes sensitive system code without proper authorization. This vulnerability compromises the confidentiality. SAP NetWeaver permite a un atacante eludir las comprobaciones de autorización, lo que le permite ver fragmentos de código ABAP que normalmente requerirían va... • https://me.sap.com/notes/3577131 • CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 0CVE-2024-45285 – Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
https://notcve.org/view.php?id=CVE-2024-45285
10 Sep 2024 — The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a crafted packet in the function module targeting specific parameters, the specific targeted user will no longer have access to any functionality of SAP GUI. There is low impact on integrity and availability of the application. • https://me.sap.com/notes/3488039 • CWE-862: Missing Authorization •
CVSS: 6.4EPSS: 0%CPEs: 15EXPL: 0CVE-2024-45279 – Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)
https://notcve.org/view.php?id=CVE-2024-45279
10 Sep 2024 — Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker to craft a URL link which could embed a malicious JavaScript. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application. • https://me.sap.com/notes/3501359 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 0CVE-2024-44117 – Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
https://notcve.org/view.php?id=CVE-2024-44117
10 Sep 2024 — The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID. There is low impact on integrity and availability of the application. • https://me.sap.com/notes/3488039 • CWE-862: Missing Authorization •
CVSS: 3.3EPSS: 0%CPEs: 15EXPL: 0CVE-2024-41728 – Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform
https://notcve.org/view.php?id=CVE-2024-41728
10 Sep 2024 — Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects. • https://me.sap.com/notes/3496410 • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2024-44116 – Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
https://notcve.org/view.php?id=CVE-2024-44116
10 Sep 2024 — The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces. There is low impact on integrity of the application. • https://me.sap.com/notes/3488039 • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2024-44115 – Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
https://notcve.org/view.php?id=CVE-2024-44115
10 Sep 2024 — The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces, and nodes. There is low impact on integrity of the application • https://me.sap.com/notes/3488039 • CWE-862: Missing Authorization •
CVSS: 3.3EPSS: 0%CPEs: 13EXPL: 0CVE-2024-44114 – Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform
https://notcve.org/view.php?id=CVE-2024-44114
10 Sep 2024 — SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application. • https://me.sap.com/notes/3507252 • CWE-863: Incorrect Authorization •